Security Guide > Domain Security > Cipher Suites for the Informatica Domain
  

Cipher Suites for the Informatica Domain

You can configure the cipher suites that the Informatica domain uses when it encrypts connections within the Informatica domain. Connections from the Informatica domain to resources outside of the domain are not affected by the cipher suite configuration.
When you enable secure communication for the Informatica domain or secure connections to web application services, the Informatica domain uses cipher suites to encrypt traffic.
Informatica creates the effective list of cipher suites that it uses based on the following lists:
Blacklist
List of cipher suites that you want the Informatica domain to block. When you blacklist a cipher suite, the Informatica domain removes the cipher suite from the effective list. You can add cipher suites that are on the default list to the blacklist.
Default list
List of cipher suites that Informatica domain supports by default. If you do not configure a whitelist or blacklist, the Informatica domain uses the default list as the effective list.
For more information, see Default List of Cipher Suites
Whitelist
List of cipher suites that you want the Informatica domain to support. When you add a cipher suite to the whitelist, the Informatica domain adds the cipher suite to the effective list. You do not need to add cipher suites that are on the default list to the whitelist.
Informatica creates the effective list by adding cipher suites from the whitelist to the default list and removing cipher suites on the blacklist from the default list.
Consider the following guidelines for effective lists:

Create the Cipher Suite Lists

To configure the Informatica domain to use specific cipher suites, create a whitelist specifying the additional cipher suites to support. You can also create a blacklist specifying the cipher suites to block.
Work with your network security administrator to determine the cipher suites that are suitable for the Informatica domain.
The list of cipher suites must be a comma-separated list. Use the Internet Assigned Numbers Authority (IANA) names for the cipher suites in the list. Alternatively, you can use a regular Java expression.
You configure the whitelist and blacklist with infasetup. You can provide the lists directly in command parameters or specify plain-text files that contain comma-separated lists.
The following sample text shows a list with two cipher suites:
TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA
You can configure the whitelist and blacklist of cipher suites for the Informatica domain when you create the domain. Use infasetup to create the Informatica domain, gateway nodes, and worker nodes. For more information about infasetup commands, see the Informatica Command Reference.
Alternatively, you can configure the whitelist and blacklist for an existing Informatica domain.

Default List of Cipher Suites

By default, the Informatica domain uses the following cipher suites for secure communication within the domain and secure client connections:

Configure the Informatica Domain with a New Effective List of Cipher Suites

To configure the cipher suites that the Informatica domain uses, you must update the Informatica domain, all gateway nodes, and all worker nodes with the same whitelist and blacklist.
Note: Changes to the blacklist, whitelist, and effective list are not cumulative. Informatica creates a new effective list based on the blacklist, default list, and whitelist when you run the command. The new effective list overwrites the previous list.
To configure an existing Informatica domain with a new effective list of cipher suites, perform the following steps:
    1. Shutdown the Informatica domain.
    2. Optionally, run the infasetup listDomainCiphers command to view the lists of cipher suites that a domain or node supports or blocks.
    For example, run the following command to view all the cipher suite lists:
    infasetup listDomainCiphers -l ALL -dc true
    3. Run the infasetup updateDomainCiphers command on a gateway node and specify a whitelist, blacklist, or both.
    For example, run the following command to add one cipher suite to the effective list and remove two cipher suites from the effective list:
    infasetup updateDomainCiphers -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA
    4. Run the infasetup updateGatewayNode command on each gateway node and specify a whitelist, blacklist, or both.
    Use the same whitelist and blacklist as the domain.
    For example, run the following command:
    infasetup updateGatewayNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA
    5. Update each worker node with the same set of cipher suites as the Informatica domain.
    Use the same whitelist and blacklist as the domain.
    For example, run the following command:
    infasetup updateWorkerNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA
    6. Start the Informatica domain.
    7. Optionally, run the infacmd isp listDomainCiphers command to view the lists of cipher suites that a domain or node uses.
    For example, run the following command to view the effective list of cipher suites that the domain uses:
    infacmd isp listDomainCiphers -l EFFECTIVE